SOO Histology FINAL.pdf

STATEMENT OF OBJECTIVES

Reagents, equipment, and services for high throughput specimen processing services including Immunohistochemistry (IHC) staining, In-situ Hybridization (ISH) staining, Immuno-Fluorescence staining, Special Staining, Whole slide scanning, Image management, and Anatomic Pathology Lab workflow, integration, and connectivity solutions.

Department of Pathology and Area Laboratory Services (DPALS) Brooke Army Medical Center (BAMC)

1. GENERAL REQUIREMENT:

The Department of Pathology and Laboratory Services at Brooke Army Medical Center, JBSA - Fort Sam Houston, Texas has a requirement for Reagents, equipment, and services for high throughput specimen processing services including Immunohistochemistry (IHC) staining, In-situ Hybridization (ISH) staining, Immuno-Fluorescence staining, Special Staining, Whole slide scanning, Image management, and Anatomic Pathology Lab workflow, integration, and connectivity solutions. The number of tests per year are identified in the workload data table (Table 1).

2. PURPPOSE:

The Government's requirement is to obtain a fully automated sample preparation and consultation system for Brooke Army Medical Center (BAMC) Department of Pathology and Area Laboratory Services Histology Laboratory, Fort Sam Houston, Texas. The Histology fully automated sample preparation and consultation system should provide high throughput processing services including the following:

• Immunohistochemistry (IHC) staining

• In-situ Hybridization (ISH) staining

• Immuno-Fluorescence staining

• Special Staining

• Whole slide scanning

• Image management

• Anatomic Pathology Lab workflow, integration, and connectivity solution

• Routine Staining (i.e. H&E)

• Automated glass coverslipping

To be able to conduct these tests, reagents and automated analyzers are needed for period of performance of 1 October 2025 to 30 September 2029. The equipment must be able to connect to the MHS Genesis and must come with an rm-interruptible power supply capable of providing power for at least 45 to 60 minutes. All in- vitro diagnostic equipment and supplies must be approved by the FDA. All detailed information regarding delivery and installation is provided in the SOO.

3. SCOPE OF WORK

3.1. The Contractor shall provide histology staining reagents and Instrumentation and service used in support of the Histology Lab Processes at Brooke Army Medical Center (BAMC) located at Joint Base San Antonio, TX, 78234. The Contractor shall provide reagents, equipment, and services for high throughput specimen processing services including Immunohistochemistry (IHC) staining, In-situ Hybridization (ISH) staining, Immuno-Fluorescence staining, Special Staining, Whole slide scanning, Image management, and Anatomic Pathology Lab workflow, integration, and connectivity solutions to meet the Histology laboratory mission of Brooke Army Medical Center (BAMC), JBSA, Fort Sam Houston, TX. All supplies and equipment outlined in this Statement of Work (SOW) must be supplied and serviced through a single Contractor (to whom the contract is awarded). All costs integrated into this contract must be calculated as cost per reportable result. Costs shall include equipment use, all reagents, standards, controls, supplies, consumables/disposable items, parts, accessories and any other items(s) required for the proper operation of the contractor's equipment that is necessary for the generation and reporting of a test result, all necessary maintenance to keep the equipment in good operating condition (this includes both preventative maintenance and emergency repairs) and, training for Government personnel. All supplies and work performed shall preserve the US Food and Drug Administration (FDA)/Emergency Use Authorization (EUA) approved status. The Contractor shall be responsible for maintenance service, on-site repair and parts as required. The machines must be in operational status for processing samples 98% of the time during the department's hours of operation Monday through Friday. All in-vitro diagnostic testing materials, to include reagents analyzers, and equipment, must be FDA approved, or approved under Covidl9 UA status.

4. ORDERING PERIOD:

1 October 2025 - 30 September 2029

4.1. The Government will order items on an as needed basis and shall only pay for the actual number of tests ordered, received, and accepted by the Government. The quantities listed in the workload data table represent anticipated test volumes for the period of performance listed; however, quantities could increase and/or decrease during certain periods and/or months.

4.2. The inspection and acceptance for all deliverables rendered under this contract will be by the appointed Ordering Officer. The performance by the contractor technician, the quality of services rendered, and any documentation or written material in support of same, shall be subject to continuous inspection, surveillance, and review for acceptance by the designated ordering officer representative. Other evaluation factors will be monitored that are not quantified by numerical measurements.

5. HOURS OF OPERATION:

The histology lab is in operation 13 hours a day, 5 days a week with on-call support 24 hours a day 7 days a week. Normal business hours for administrative personnel are Monday through Friday between the hours of 0800- 1630 CST. Contractor shall coordinate maintenance scheduled with Ordering Officer (00) and appointed on duty staff in absence of 00 no less than 48 hours.

6. SECURITY REQUIREMENTS AND SAFETY:

6.1. SECURITY. The Contractor shall ensure its personnel comply with the local installation requirements for vehicle registration and operation on the military facility. Any vehicle entering the military installation must have the minimum liability coverage required by the state in which the performance is located. The Contractor shall ensure its personnel comply with installation and Military Treatment Facility (MTF) personnel identification and access requirements.

6.2. SAFETY. The Contractor shall ensure its personnel comply with all installation and MTF safety regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal. Copies of these regulations are available in the medical activity safety office or may be obtained through the appointed personnel. The government and the contractor's service representative will exchange hazard communication information before the commencement of any repair. When required, the contractor's service representative will comply with the Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing sustainment on

MD/MDS.

7. INSTRUMENT/EQUIPMENT REQUIREMENT (OWNED BY CONTRACTOR):

7.1. Contractor shall provide all instruments/equipment necessary to conduct testing as per workload data table on the testing identified. In addition, the instrument/equipment must include an automated component that facilitates ease of sample preparation and seamless input of data via barcode scanning.

A printer to produce hard copy reports generated shall also be provided.

7.2. All in-vitro diagnostic equipment and supplies, to include any connections between the instruments/equipment, shall be approved by the US Food and Drug Administration (FDA).

7.3. Ability to manage processing workflow of hospital laboratory. Processing configuration ofIHC, Special stains, and routine staining platforms must provide for backup equipment with equivalent menus utilizing the same reagent formulation to ensure correlation with primary instrument and backup instrumentation.

7.4. Routine Stainers must have a minimum throughput of 200 slides per hour.

7.5. Vendor solution must be scalable and able to connect multiple modules together to increase efficiency and reduce space requirements in the laboratory.

7.6. Integrated modules must require as few system control centers (computer and screen) to simplify operations while maintaining and operating.

7.7. Instruments must have continuous load capabilities for reagents, samples, bulk solutions, and consumables.

7.8. Vendor must have commonality across all analyzer platforms for the following:

7.8.1 Software

7.8.2 Reagents

7.8.3 Consumables

7.8.4 Methodology

7.9. Each IHC or Special stainer must have a minimum of 25 reagent slots to allow for maximum load up of reagents to increase walkaway time and reduce technologist intervention.

7.10. Instruments must be available for full front loading of samples, reagents, consumables and bulk solutions on the fly and priority specimen options over routine processing.

7.11. Equipment must have flexible priority specimen options to prioritize the most critical samples based on workflow.

7.12. Equipment must feature error-proofreagent and commodity design with built in safeguards to prevent reagent mix-ups, probe crashes and unnecessary downtime.

7.13. Equipment must be capable of monitoring reagent usage, maintaining and storing on board supplies/reagents for 24 hours of specimen processing on the combined platform, and providing reagent inventory upon request, in real time.

7.14. Equipment must have minimal daily, weekly, and monthly maintenance downtime. Please provide total maintenance times, for daily, weekly, and monthly maintenance. Please include any hands on, automated non-maintenance activities.

7.15. Vendor to provide average number of service calls per year per analyzer.

7.16. Vendor must provide BTU output for all equipment.

7.17. Each piece of equipment shall have automated inventory tracking as appropriate.

7.18. The instruments supplied, all its associated parts, and all accessories must be maintained at the most up-to-date hardware and software. When necessary to maintain hardware updates, the existing instrument/equipment, associated parts, and accessories must be exchanged by the contractor. All software updates or file exchange shall be completed in accordance with DOD and Cybersecurity requirements.

7.19. The instruments in provided for the system shall be equipped with an Uninterruptible Power

Supply (UPS) capable of providing all necessary electrical power to the instrument/equipment system for at least 45 to 60 minutes.

7.20. The instruments shall be able to be connected to the hospital LIS, currently MHS Genesis or whichever LIS system the hospital uses in the future. The contractor must provide full technical support to ensure that the LIS connectivity is functioning properly.

7.21. Risk Management Framework Compliance. The contractor must acknowledge and demonstrate willingness and ability to comply with the DHA Cybersecurity RMF Requirements, to include specifically acknowledging Exhibit 1, RMF Timeline, and completion of Exhibit 2, Medical Device Risk Assessment Questionnaire.

7.22. The instruments, reagents, and software provided shall comply with the specific requirements listed in this SOO.

7.23. Software upgrades. Contractor shall have access to all necessary diagnostic software. All software upgrades, corrective in nature, shall be at no-cost to the government.

7.24. Contractor shall provide all documentation required to meet all regulatory compliance testing procedures.

7.25. Contractors shall coordinate and conduct a site visit if necessary to the BAMC Histology section, for the purpose of surveying and assessing current laboratory set-up, laboratory environmental control, and available utilities with regard to potential placement of their instruments in the laboratory. Any changes to the layout of the laboratory, environmental control, or to utilities as currently in existence to accommodate placement of their proposed instruments must be identified.

7.26. The Contractor will provide one (1) paper copy and one (1) Digital copy of the Operator's and Maintenance manuals and a statement of the warranty terms.

8. PREVENTATIVE MAINTENANCE, FAILURES AND REPAIRS:

8.1. The contractor shall provide all personnel, equipment, tools, materials, supervision, parts, transportation, and other items and services necessary to perform all required repairs and scheduled preventive maintenance/safety inspections and calibrations of their equipment. Contractor shall coordinate with the designated point of contact all scheduled maintenance within ten (10) business days prior to performing preventative maintenance services.

8.2. The performance of scheduled periodic preventive maintenance, safety checks, and calibrations that are not normally performed at the operator level will be performed by contractor service personnel in accordance with requirements as specified in the contractor's instrument maintenance manual. The contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required by manufacturer in order to maintain the system in optimal operating condition.

8.3. The contractor shall provide a full-service plan to include the recommended unscheduled and preventive maintenance service for their instrument/equipment period. Service shall include repair and replacement of defective parts, complete maintenance program (as required by the manufacturer's maintenance manuals), and hotline telephone service, in order to assist customer in troubleshooting problems.

8.4. Preventive maintenance services shall be performed in accordance with the manufacturer's standard/procedures. A preventive maintenance service shall include, but is not limited to, safety, calibration, complete operational testing, lubrication, adjustments, and cleaning of equipment to which the operator does not have access. This also includes the installation of all non-operator parts required to ensure proper operation.

8.5. Upon notification of equipment failure own by contractor, the contractor shall respond to telephonic requests for unscheduled repair within 24 hours. Should the instrument/equipment become inoperable, the contractor's Repair Service Engineer/ technician shall be on-site within 24 hours of initial notification for routine/emergency failures. If the equipment is out of service for longer than 72 hours (from the time-of-service technician's arrival on site), the contractor shall notify the government point of contract on duty, in writing, as to the reason(s) (i.e. non-availability of parts, etc.) for non-compliance.

8.6. If the equipment cannot be repaired, a replacement instrument shall be provided within seven (7) days. If the equipment cannot be replaced, the Government may seek remedies for non-compliance with terms and conditions of this contract.

8.7. Within one (1) business day after completion of a repair, the contractor's representative shall furnish the Point of Contact (POC) one (1) copy of a service report for all services performed. The service report shall contain, at a minimum, the following information:

a. Nomenclature, date, description of services performed (i.e., preventative maintenance service, or unscheduled repair service)

b. Location of services performed, duration of services performed, list of parts replaced and;

c. Other actions taken to restore operability of the instrument/equipment, name of technician.

**Full report shall be submitted to designated government point of contact**

8.8. Contractor shall notify government of any hazard information before beginning equipment repair and shall comply with the Occupational Safety and Health Administration while performing maintenance on electrical equipment.

8.9. When appropriate, the contractor's representative shall attach and complete a DD Form 2163

(sticker), entitled "Medical Equipment Verification/Certification" to the equipment upon completion of calibration services. The Point of Contact will provide the DD Form 2163 to the contractors' representative. If the DD Form 2163 is already attached to the equipment, the contractors' representative shall update the existing DD Form 2163. Procedures for updating the 2163 will be provided by the Point of Contact.

9. CUSTOMER SERVICE:

9.1. The Contractor shall provide direct customer service and support, during normal business hours and on-call emergency repair service support, to assist operators in correcting equipment operation problems.

9.2. For Emergency Services and unscheduled services, the Contractor's qualified service technician shall be on-site to provide emergency service (service requiring immediate repair) within 24 hours. The equipment shall be repaired and operational at the minimum of 72 hours after arrival of contractor on site.

9.3. The Contractor shall perform preventive maintenance services (PMS), safety tests, calibrations, and unscheduled repair services in accordance with procedures and practices prescribed by the manufacturer of the equipment. Scheduled routine services shall be performed between 0730-1630 LOCAL Monday-Friday, excluding U.S. Holidays.

9.4. The Contractor shall provide a full unscheduled and preventive maintenance service for the instrument/ equipment owned by contractor. All maintenance and repairs shall be inclusive of all costs for the performance of scheduled periodic maintenance (as required by the Contractor's instrument maintenance manuals), unscheduled maintenance and repair of the analyzers and any associated equipment provided by the Contractor as part of the analyzer system, including replacement parts, replacement part shipment costs, and service technician travel costs for performance of maintenance services.

9.5. The contractor's qualified service technician shall be on site to provide routine services; service requiring immediate repair; and scheduled services for preventive maintenance (as specified in the Contractor's instrument maintenance manual), safety and calibration as required by this statement of work. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

9.6. Upon analyzer failure, the Contractor's qualified service technician shall be on-site to provide unlimited emergency service (service requiring immediate repair; an unscheduled maintenance/service requirement) within 24 hours. The equipment shall be repaired and operational within 72 hours after arrival of contractor on site.

9.7. Should the analyzer at BAMC become inoperable, the Contractor's technical repair specialist shall be on-site within 24 hours of initial notification and make the repair within 72 hours after arrival of contractor on site. If the analyzer cannot be repaired within 72 hours after arrival of contractor on site, a replacement analyzer, at no additional cost to the U. S. Government, will be provided within seven (7) days of the initial notification to be utilized by the U.S. Government until the original instrument is fully repaired and accepted for service.

9.8. During the period when the analyzer is inoperable, the Contractor will arrange the pickup and delivery of critical specimens to a College of American Pathologists accredited clinical laboratory of their choice. The selected laboratory will provide patient reports. Each patient report shall include the testing laboratory's reference range for the test being performed. The Contractor will be responsible for all costs associated with the provision of this service, including those for delivery of hardcopy patient results, for as long as the analyzer remain inoperable.

9.9. The Contractor shall provide all necessary user-replaceable maintenance items that will be required to support the analyzer, and any analyzer specific tools/supplies necessary to perform operator-level periodic maintenance tasks, at no additional cost to the U.S. Government.

9.10. Minimal Hands-on System Maintenance required, including limited reagent preparation time/steps prior to use.

9.11. Computer Patient Data Handling: No hardware, containing any patient information is to be removed from any location, without the approval and removal of data by the facility information technology department.

9.12. Preventative and Predictive Maintenance: Contractor shall provide regular, scheduled maintenance to assure the continued reliable operation of the equipment. These preventive maintenance visits shall be of a frequency that conforms to the manufacturer's operation and maintenance instructions for the supported equipment. Minimum of I per year per instrument unless documentation for volume performed denotes not required for optimum quality of operation.

9.13. Emergency Repair: Emergency repairs shall be performed after notification that the equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable its maintenance representative to receive such notification. The contractor shall perform emergency repair service within 24 hours of time of notification of the malfunction.

9.14. Maintenance Support: Service repair person locally based within San Antonio geographical area,

9.15. Operator Procedure Manuals: Operator and Service manuals along with Clinical and Laboratory

Standards Institute (CLSI) compliant procedures must be furnished for each instrument model supplied, unless provided electronically on board the instrument. Vendor to write Standard Operating Procedures for each assay in the laboratory template, to ensure that procedures are totally available prior to implementation.

10. DELIVERY OF EQUIPMENT

10.1. All equipment (owned by contractor) shall include delivery, installation, maintenance, and removal upon termination of contract. Contractor shall furnish all necessary calibrators/standards and quality control materials necessary to perform the initial method verifications per CLIA/NCCLS guidelines.

10.2. The instrument (s)/ equipment shall be delivered to the Brooke Army Medical Center (4th floor) within 30 days or less after contract award. Exact installation location shall be coordinated by contractor and government point of contact (OIC and/or NCOIC). Equipment setup, LIS connectivity, on-site training, and method verification studies, shall be completed by vendor personnel within six (6) weeks or less after contract award to ensure that equipment is fully operational.

10.3. SAFETY DATA SHEETS (SDS): The contractor shall provide safety data sheets (SDS) for each item delivered under this contract that is considered to be HAZARDOUS MATERIAL. The SDS shall contain information on the hazards associated with each specific chemical or material. The SDS shall contain at a minimum the following information: identification of the specific hazard, the required practice for the safe use of the product, first aid procedures, and what to do in the event of a spill or other mishap or accident.

10.4. The contractor shall be responsible for installation, which consists of in-house delivery, positioning, and mounting of all equipment listed on the delivery order and connections of all equipment and interconnecting wiring and cabling if applicable in coordination with the facility biomedical engineer. Upon receipt of notice to proceed with installation, it shall be the contractor's responsibility to inform the Contracting Officer of any problems which may be anticipated in connection with installation, or which will affect optimum performance once installation is completed. In the event that progress of the installation is interrupted through no fault of the contractor, the continuous installation referenced in the preceding paragraphs may be terminated until such time as the cause of delay has been eliminated, and then shall be resumed within 24 hours after the contractor has been notified that work may again proceed.

10.5. Vendor shall provide equipment installation and possible reinstallation at minimal costs if the equipment is required to be moved due to construction or laboratory redesign.

11. REAGENTS/CONSUMABLES:

11.1. As indicated in the FDA safety alert communication, assays that use free capture streptavidin/biotin in their assay architecture have been demonstrated to show interference which can lead to misdiagnosis and medical error. We require that the imrnunoassays must not use free-capture streptavidin/biotin in the assay architecture to minimize the risk of interference from ingested biotin.

11.2. Vendor reagents must be 99% liquid ready to use from storage, requiring no reconstitution or mixing. List all Reagents that are not liquid, ready to use.

11.3. Quality of Reagents, Supplies and Disposables: The contractor shall assure that all supplies provided/ordered for use on their equipment will be of the quality necessary to produce a quality product. The reagent quality must be high enough to satisfy proficiency testing standards of the CAP and the Joint Commission. In the event that the supplies are found to be defective and unsuitable for use with the contractor's equipment or the contractor has failed to comply with the requirements herein, the contractor is required to deliver the supplies within 24 hours of receipt of the verbal order.

11.4. Vendor must provide 5 years of FDA field action notifications

11.5. All reagents and quality control material shall be provided by the manufacturer of the equipment;

be marked with the required storage temperature and expiration dates; be maintained at the proper storage temperature during transportation from the Contractor's storage facility to the U.S.

Government acceptance site and be delivered on time at the appropriate storage temperature.

Preservation and packing - Preservation and packing shall be performed in accordance with the best commercial practices and in such a manner to afford adequate protection against any damage during shipment from source to destination.

11.6. The reagents and quality control material must perform within the manufacturer's stated/published package inserts. Deliveries ofrequired items will be called in to the Contractor by the designated Contracting Officer's Representatives. Orders will be delivered within five (5) business days of requested date of delivery.

11.7. Emergency orders will be delivered within 24 hours using overnight shipping, or, if this shipping requirement cannot be met, the Contractor shall identify the guaranteed emergency order shipping method that can be accommodated in their response to the Solicitation for Bid.

12. TRAINING:

12.1. The Contractor will provide initial operator training to all technicians assigned to the U.S.

Government site (BAMC Department of Pathology Microbiology staff), as well as annual refresher training, as needed, to ensure adequate user competency during times of personnel turnover.

12.2. All training manuals/guides, instructional literature, and any other related written/electronic material shall be provided. Training shall include basic operation of the analyzers, troubleshooting procedures, performance of operator-level periodic preventive maintenance procedures, and use of the data management/quality control software.

12.3. In addition, the contractor shall provide supplemental operating training to above government personnel, without additional charge to the government, upon installation of the upgrade in equipment hardware or operating system software connected with the operation of an instrument already furnished.

12.4. In the case of any significant software or assay procedural updates, the Contractor shall provide one (1) primary (key) operator training slot per major instrument/equipment, one (1) key operator Training per new instrument install, one (1) key operator raining for the existing instrumentation, two

(2) On-site in lab training slots for the instrumentation to be used over the 5-year term of the agreement as the lab needs for staff changes. This training can be on or off-site at the Contractor's full expense.

13. INFORMATION SECURITY

13.1. The Contractor shall comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

13.1.1 United States Law

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• The Federal Information Security Management Act (FISMA)

• The E-Government Act of 2002

13.1.2 Office of Management and Budget (0MB)

• Circular A-130

• Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and

Vendors

13.1.3 National Institute of Standards and Technology (NIST)

• NIST Special Publication (SP) 800-37 - Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

• NIST SP 800-39-Managing Information Security Risk: Organization,

• NIST SP 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-60-Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories

13.1.4 Federal Information Processing Standards (PIPS)

• PIPS Publication (PIPS PUB) 140-2, Security Requirements for Cryptographic Modules

• PIPS PUB 199 - Standards for Security Categorization of Federal Information and Information Systems

• PIPS PUB 200: Minimum Security Requirements for Federal Information and Information Systems

• PIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

13.1.5 Department of Defense (DoD)

• DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

• DoD Instruction 8500.1, Cybersecurity

• DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

• DoD Instruction 8510.01, Risk Management Framework Process (RMF)

• DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

• DoD Instruction 8580.02, Security oflndividually Identifiable Health Information in DoD Health Care Programs

• DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

• DoD Directive 5400.11, DoD Privacy Program

13.2. TELECOMMUNICATION

13.2.1 Systems that provide the ability to control instrument software from remote locations are preferred. All Contractor systems that communicate with Department of Defense (DoD) systems shall interconnect through the established Military Healthcare System (MHS) Virtual Private Network (VPN) Business to Business (B2B) gateway. For all Web applications, Contractors shall connect to a Defense Information Systems Agency (DISA)-established Web Demilitarize Zone (DMZ). All software shall be able to pass MITC testing and review and be awarded a Certificate of Net worthiness (CoN) from NETCOM. Submission of the CoN shall be completed within six

(6) months of contract award.

13.2.2 In accordance with contract requirements, Contractors shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection. The Contractor shall assume all responsibility for establishing and maintaining their connectivity to the B2B gateway.

This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

13.2.3 The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies and will provide, maintain and configure VPN concentrator that complies with DoD security standards.

13.2.4 All costs for VPN hardware and software shall be incurred by the Contractor.

13.2.5 The Contractor shall initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative's responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chieflnformation Officer.

13.2.6 The Contractor shall validate that systems authenticate users through the use of the

Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN. The Contractor shall also identify the exact location from which remote operational control will take place from, the encryption that will be used, and how the vendor's technical users will maintain secure logon.

13.3. RISK MANAGEMENT. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security. "Vendors shall ensure ability to conform to all standards set forth by Department of Defense Risk Management Framework."

13.4. BUSINESS TO BUSINESS (B2B) PARTNERS AND 3rd PARTY VENDORS-General Security

Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of Government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow

13.5. PERSONNEL SECURITY.

13.5.1 Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

13.5.2 Follow the DoD guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all Contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

13.5.3 Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to Information Systems within the logical boundaries of the facility local area network (LAN).

13.5.4 Immediately report to the MTFs Security Office and deny access to any automated information system (AIS), network, or information if a Contractor personnel filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Government representative for any reason.

13.5.5 Ensure that all Contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

13.5.6 Access and General Protection/Security Policy and Procedures. Contractor and all associated sub-contractor's personnel shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as direct by DOD, HQDA, and or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, shall the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

13.6. ELECTRONIC SECURITY.

13.6.1 Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of SAMMC shall operate in accordance with controlling laws, regulations, DoD/DHA, and local policy.

13.6.2 Risk Management Framework(RMF) requirements apply to all DoD/DHA and

Contractor's IS/networks that receive, process, display, store or transmit DoD information. The Contractor shall comply with the RMF process for safeguarding IS.

13.6.3 Authorization to Operate is the formal approval by the Government to operate the Contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, authorization allows IS/networks to operate within the given operational environment with stated interconnections, and with appropriate monitor level of protection for the specified period.

13.6.4 The Contractor shall comply with RMF requirements, as specified by the Government that meet appropriate DoD/DHA Information Assurance requirements. The RMF requirements shall be met before the Contractor's system is authorized to access DoD/DHA data or interconnect with any DoD/DHA IS/network that receives, processes, stores, displays or transmits DoD/DHA data. The Contractor shall ensure the proper Contractor support staff is available to participate in all phases of the RMF process. They include, but are not limited to:

• Attending and supporting RMF meetings with the Government

• Supporting/conducting the vulnerability mitigation process

• Supporting the RMF Team during system security testing

13.6.5 Contractors shall confirm that their networks are locked down prior to initiating testing.

• Conformation of system lock down shall be agreed upon during the definition of the RMF boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

• Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

13.6.6 Any re-configuration or change in the system during the C&A testing process shall require a re- base lining of the system and documentation of system changes. Some changes will necessitate a pause in work depending on the severity and impact of change and determined by the COR in conjunction with the IA representative.

13.6.7 Vulnerabilities that have been identified by the DHA as "must-fix" issues during C&A process shall be mitigated according to the timeline identified by the DHA Representative. C&A Checklists are provided for complying DHA C&A requirements.

13.6.8 A request for a waiver to the C&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request shall be submitted, in writing, to the Designated Approving Authority (DAA). The request shall include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

13.6.9 Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The DHA IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to DHA systems. As part of the program, the contractor shall provide a primary and secondary point of contact for IAVM compliance reporting. The contactor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance to the DHA IA Operations POC.

Receipt and compliance messages to DHA shall occur within the stipulated time window, as stated in the vulnerability message.

13.6.10 Guidance regarding the requirement for IAVM is contained in the Army Regulation 25- 2, "Information Assurance" and Army Regulation 25-1, "Army Knowledge Management and Information Technology." An asset is defined as any hardware device, such as a router, firewall, server, or an operating system image accessed by more than one user. The "MEDCOM IASO list server is the primary means to disseminate IAVAs, Information Assurance Vulnerability Bulletins (IAVBs), and Information Assurance Technical Advisories down to the System Administrator (SA) and applicable personnel throughout the chain of command. Requests to be added to the IASO list server shall be sent to medcom.ia@amedd.army.mil.

13.6.11 The contractor shall maintain any development environments in accordance with MEDCOM Information Assurance (IA) best practices and operational requirements. During product development for the Army, the contractor shall ensure that all IA mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery.

13.6.12 IA mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

13.6.13 Disposing of Electronic Media. Contractors shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25-2, "Information Assurance" and Army Best Business Practices (BBP), "Reuse of Computer Hard Drives."

13.6.14 Ports Protocols and Services. Contractors shall follow all current Army standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires a request for exception sent through the Program Manager to the DAA.

13.6.15 Public Key Infrastructure and Encryption. Contractors shall follow the Army standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its contractors and contractors, industry partners shall obtain all necessary certificates. Contractors shall turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Contractor shall provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions.

13.7. INFORMATION SYSTEMS (IS)/NETWORKS PHYSICAL SECURITY.

13.7.1 The Contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a Physical Security mailto:medcom.ia@amedd.army.mil

Audit performed by the Government of the Contractor's internal information management infrastructure.

13.7.2 The MHS Physical Security Audit information is available at:

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version .xis�

13.7.3 The Contractor shall correct any deficiencies identified by the Government of the

Contractor's physical security posture. New Army policies will be posted to the following website:

http://www.apd.army.mil/

13.8. SPECIAL REQUIREMENTS FOR PROTECTED HEALTH INFORMATION.

13.8.1 Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the Contractors shall :

• Notify the MTF HIPAA Security Manager.

Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

14. SPECIAL REQUIREMENTS FOR AWARDED CONTRACTOR:

Vendor must meet, or improve, each Laboratory's existing tum-around times as a minimum, by any change in instrumentation. Proposal should include automated pre-analytical specimen processing for Anti-nuclear antibodies (ANA; quantitative dsDNA; semi-quantitative Chromatin, Ribosomal-P protein, SS-A, SS-B, Sm, SmRNP, RNP, ScI-70, Jo-1, and Centromere B), Epstein-Barr virus (EBV; IgG for VCA, NA-1, and EA-D; IgM for VCA and heterophile), T. gondii, rubella, and cytomegalovirus (ToRC;

IgG quantitative for Toxoplasma gondii and Rubella, IgG qualitative for Cytomegalovirus; IgM qualitative for T. gondii, Rubella, and Cytomegalovirus), Herpes simplex virus 1 and 2 (HSV 1/2;

differentiates IgG for types 1 and 2), Measles, mumps, rubella, and varicella-zoster (MMRV; qualitative detection oflgG for measles, mumps, rubella, and varicella-zoster),Vasculitis (semi-quantitative IgG for MPO, PR3, and GBM), Syphilis (qualitative IgG and IgM for Treponema pallidum and quantitative detection and/or titer for non-treponema reagin), Lyme Total (qualitative IgM and IgG for Borrelia burgdorferi), and Antiphospholipid Syndrome (APLS; IgG, IgM, and IgA for anti-Cardiolipin and anti- Beta-2 Glycoprotein I) Method Performance/Comparison shall be at the expense of the Vendor, shall include linearity material and reagents, and be consistent with current CLSI Standards and related documents, CAP Standards and Federal Regulations, for the following:

14.1. Correlation studies for each analyte. A minimum of 20 samples, spanning the reportable range, shall be run by the present and the new contracted method. Vendor shall analyze numbers and provide statistical data to accept the new method. Statistics shall consist of at least mean, bias, slope, y-intercept, correlation coefficient, and meet current standards defined by CLSI.

14.2. Linearity analysis shall be performed on new contracted instrument(s) for each analyte to determine reportable range with data reduction in accordance with CLSI guidelines.

14.3. Precision study shall be performed utilizing normal and abnormal control material. This should consist of a within run precision study of 10 normal and 10 abnormal controls and a day-to-day precision study of normal and abnormal controls.

http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version http://www.apd.army.mil/

14.4. Sensitivity: Sensitivity may be validated concurrently with the linearity verifications.

14.5. Specificity studies: Adverse effects for increased bilirubin, hemolysis, lipemia, or other interrupting substances including blood and urine container are evaluated for interfering substances for each method performed.

14.6. Reference Range: Determine a reference range for each test following CLSI guideline C-23A.

Samples used for the reference range study must be representative of the patient population being tested. Reference range assessment must be performed for each lab. One of the following protocols should be used:

a. If the suggested manufacturer's range is not appropriate for the patient population, a reference range must be established and may require additional reference individuals.

b. If a laboratory is currently using the proposed instrument/reagent system, the "in-use" reference range can be transferred to the "new" system if a method comparison study between the two systems proves to be acceptable. If comparison studies are not acceptable, then an alternate test must be provided.

14.7. Analytical Measurement range validation studies must be performed by vendor for applicable analytes.

14.8. All technical procedures must be provided electronically by vendor in CLSI format, using software compatible with each Laboratory's computer system, for local modification (editable) to meet CAP requirements.

14.9. Carryover studies must be performed, as applicable, as part of the initial evaluation of the instrument. Vendor shall provide interpretation of raw data for each instrument installed and validate no carryover exists within the test platforms.

14.10. Vendor to provide all reagents, calibrators, and controls needed along with technical assistance to perform correlation studies from a single lot at no additional cost for new test methods or changes in test menus. (i.e., vendor is to provide all manpower and reagents/supplies to do correlation studies).

Additional System Requirements:

1. Comprehensive on board QC Program, including Troubleshooting or System Validation QC material. The system must have quality control data storage and reporting capabilities, the ability to view and print daily and monthly QC results, view and print Levy Jennings graphs, visually alert the operator of QC failures and to document out of range QC.

2. Upgraded Software/ Equipment: The Contractor shall provide all upgrades to the equipment hardware and operating system software without additional charge to the government. These enhancements to the contractor's equipment shall be delivered to the government site and installed by the contractor within 60 days of their issuance or date of first commercial availability.

3. New Test Methods: Vendor/technical support specialist shall perform all validation studies including installation/set-up, correlation studies (evaluation/comparison data sufficient to satisfy CAP/CLSI standards) and normal range studies at no initial charge.

Maintenance and Service Support Requirements:

1. Minimal Hands-on System Maintenance required, including limited reagent preparation time/steps prior to use. List reagent /calibrator prep for assays.

2. Computer Patient Data Handling: No hardware, containing any patient information is to be removed from any location, without the approval and removal of data by the facility information technology department.

3. Preventative and Predictive Maintenance: Contractor shall provide regular, scheduled maintenance to assure the continued reliable operation of the equipment. These preventive maintenance visits shall be of a frequency that conforms to the manufacturer's operation and maintenance instructions for the supported equipment. Minimum of 1 per year per instrument unless documentation for volume performed denotes not required for optimum quality of operation.

4. Emergency Repair: Emergency repairs shall be performed after notification that the equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable its maintenance representative to receive such notification.

The contractor shall perform emergency repair service within 24 hours of time of notification of the malfunction.

5. Maintenance Support: Service repair person locally based within San…